[heap] Color object black on unsafe layout change.

src/heap/heap.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/heap/heap.h"
 
 #include "src/accessors.h"
 #include "src/api.h"
 #include "src/assembler-inl.h"
 #include "src/ast/context-slot-cache.h"
@@ skipping 4259 matching lines @@
 
   // Large object space doesn't use reservations, so it needs custom handling.
   for (HeapObject* object : *large_objects) {
     incremental_marking()->IterateBlackObject(object);
   }
 }
 
 void Heap::NotifyObjectLayoutChange(HeapObject* object,
                                     const DisallowHeapAllocation&) {
   if (FLAG_incremental_marking && incremental_marking()->IsMarking()) {
-    incremental_marking()->WhiteToGreyAndPush(object);
+    incremental_marking()->MarkBlackAndPush(object);
   }
 #ifdef VERIFY_HEAP
   DCHECK(pending_layout_change_object_ == nullptr);
   pending_layout_change_object_ = object;
 #endif
 }
 
 #ifdef VERIFY_HEAP
 void Heap::VerifyObjectLayoutChange(HeapObject* object, Map* new_map) {
   if (pending_layout_change_object_ == nullptr) {
@@ skipping 2237 matching lines @@
     case LO_SPACE:
       return "LO_SPACE";
     default:
       UNREACHABLE();
   }
   return NULL;
 }
 
 }  // namespace internal
 }  // namespace v8